CVE-2026-24765
published 2026-01-27CVE-2026-24765: PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe…
PriorityP348high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.34%
26.5th percentile
PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.
Affected
24 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | phpunit | < phpunit 9.5.2-1+deb11u1 (bullseye) | phpunit 9.5.2-1+deb11u1 (bullseye) |
| phpunit | phpunit | >= 0 < 12.5.22 | 12.5.22 |
| phpunit | phpunit | >= 0 < 8.5.52 | 8.5.52 |
| phpunit | phpunit | >= 10.0.0 < 10.5.62 | 10.5.62 |
| phpunit | phpunit | >= 11.0.0 < 11.5.50 | 11.5.50 |
| phpunit | phpunit | >= 12.0.0 < 12.5.8 | 12.5.8 |
| phpunit | phpunit | >= 12.5.21 < 12.5.22 | 12.5.22 |
| phpunit | phpunit | >= 13.0.0 < 13.1.6 | 13.1.6 |
| phpunit | phpunit | >= 13.1.5 < 13.1.6 | 13.1.6 |
| phpunit | phpunit | >= 9.0.0 < 9.6.33 | 9.6.33 |
| phpunit_project | phpunit | < 8.5.52 | 8.5.52 |
| phpunit_project | phpunit | >= 10.0.0 < 10.5.62 | 10.5.62 |
| phpunit_project | phpunit | >= 11.0.0 < 11.5.50 | 11.5.50 |
| phpunit_project | phpunit | >= 12.0.0 < 12.5.8 | 12.5.8 |
| phpunit_project | phpunit | >= 9.0.0 < 9.6.33 | 9.6.33 |
| sebastianbergmann | phpunit | < 8.5.52 | 8.5.52 |
| sebastianbergmann | phpunit | — | — |
| sebastianbergmann | phpunit | — | — |
| sebastianbergmann | phpunit | — | — |
| sebastianbergmann | phpunit | — | — |
| sebastianbergmann | phpunit | >= 0 < 9.5.2-1+deb11u1 | 9.5.2-1+deb11u1 |
| sebastianbergmann | phpunit | >= 0 < 11.5.19-1+deb13u1 | 11.5.19-1+deb13u1 |
| sebastianbergmann | phpunit | >= 0 < 12.5.8-1 | 12.5.8-1 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
PHPUnit: Argument injection via newline in PHP INI values forwarded to child processes
ghsa·2026-04-22
CVE-2026-24765 [HIGH] CWE-88 PHPUnit: Argument injection via newline in PHP INI values forwarded to child processes
PHPUnit: Argument injection via newline in PHP INI values forwarded to child processes
# Impact
PHPUnit forwards PHP INI settings to child processes (used for isolated/PHPT test execution) as `-d name=value` command-line arguments without neutralizing INI metacharacters. Because PHP's INI parser interprets `"` as a string delimiter, `;` as the start of a comment, and most importantly a newline as a directive separator, a value containing a newline is parsed by the child process as **multiple INI directives**.
An attacker able to influence a single INI value can therefore inject arbitrary additional directives into the child's configuration, including `auto_prepend_file`, `extension`, `disable_functions`, `open_basedir`, and others. Setting `auto_prepend_file` to an attacker-controlled p
GHSA
PHPUnit has Argument injection via newline in PHP INI values that are forwarded to child processes
ghsa·2026-04-18
CVE-2026-24765 [HIGH] CWE-88 PHPUnit has Argument injection via newline in PHP INI values that are forwarded to child processes
PHPUnit has Argument injection via newline in PHP INI values that are forwarded to child processes
## Impact
PHPUnit forwards PHP INI settings to child processes (used for isolated/PHPT test execution) as `-d name=value` command-line arguments without neutralizing INI metacharacters. Because PHP's INI parser interprets `"` as a string delimiter, `;` as the start of a comment, and most importantly a newline as a directive separator, a value containing a newline is parsed by the child process as multiple INI directives.
An attacker able to influence a single INI value can therefore inject arbitrary additional directives into the child's configuration, including `auto_prepend_file`, `extension`, `disable_functions`, `open_basedir`, and others. Setting `auto_prepend_file` to an attacker-con
OSV
PHPUnit Vulnerable to Unsafe Deserialization in PHPT Code Coverage Handling
osv·2026-01-27
CVE-2026-24765 [HIGH] PHPUnit Vulnerable to Unsafe Deserialization in PHPT Code Coverage Handling
PHPUnit Vulnerable to Unsafe Deserialization in PHPT Code Coverage Handling
### Overview
A vulnerability has been discovered involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test.
### Technical Details
**Affected Component:** PHPT test runner, method `cleanupForCoverage()`
**Affected Versions:** false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition.
#### Rationale for Error-Based Approach:
1. **Visibility Over Silence:*
GHSA
PHPUnit Vulnerable to Unsafe Deserialization in PHPT Code Coverage Handling
ghsa·2026-01-27
CVE-2026-24765 [HIGH] CWE-502 PHPUnit Vulnerable to Unsafe Deserialization in PHPT Code Coverage Handling
PHPUnit Vulnerable to Unsafe Deserialization in PHPT Code Coverage Handling
### Overview
A vulnerability has been discovered involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test.
### Technical Details
**Affected Component:** PHPT test runner, method `cleanupForCoverage()`
**Affected Versions:** false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition.
#### Rationale for Error-Based Approach:
1. **Visibility Over Silence:*
OSV
CVE-2026-24765: PHPUnit is a testing framework for PHP
osv·2026-01-27·CVSS 7.8
CVE-2026-24765 [HIGH] CVE-2026-24765: PHPUnit is a testing framework for PHP
PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution
Red Hat
phpunit: PHPUnit: Arbitrary code execution via unsafe deserialization of code coverage files
vendor_redhat·2026-01-27·CVSS 7.8
CVE-2026-24765 [HIGH] CWE-502 phpunit: PHPUnit: Arbitrary code execution via unsafe deserialization of code coverage files
phpunit: PHPUnit: Arbitrary code execution via unsafe deserialization of code coverage files
PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serializ
Debian
CVE-2026-24765: phpunit - PHPUnit is a testing framework for PHP. A vulnerability has been discovered in v...
vendor_debian·2026·CVSS 7.8
CVE-2026-24765 [HIGH] CVE-2026-24765: phpunit - PHPUnit is a testing framework for PHP. A vulnerability has been discovered in v...
PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution
No detection rules found.
No public exploits indexed.
https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fdahttps://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85phttps://lists.debian.org/debian-lts-announce/2026/02/msg00009.html
2026-01-27
Published